Companies heavily reliant on operational technology (OT) to function are just as much a target as businesses relying in traditional IT and are facing some of the same challenges to stop attacks.
Analysts at IBM Security X-Force have released some insightful data that should be a warning to OT-heavy industries – from how much a target they really are, to where their weak spots are.
According to the data, the Manufacturing industry, not only represents nearly two-thirds (65%) of all cybersecurity incidents across OT-reliant industries, but it also tops the list of all industries, being a target in 23% of all incidents.
In these OT industries, IBM found that 78% of all incidents began with a phishing attack, with vulnerabilities and removable media each only represented in 11% of attacks. Phishing topping the list is consistent with 2021 findings as well. Malspam, specifically, was seen in 44% of incident response engagements, with the majority of malspam incidents involving the delivery of Emotet.
IBM provides several recommendations to support a layered phishing defense, but they start with one that is critical to OT environments, where users are less savvy and are focused on operational processes – Security Awareness Training. Even IBM realizes the value of employing users to act as part of your defense when solutions focused on filtering, sandboxing, analyzing, detecting, and mitigating fail to stop a phishing email from reaching the Inbox.
OT-heavy industries need to take note of IBM’s findings and strengthen their defenses against phishing, starting with Security Awareness Training.
